[Security] XSS vulnerability in markdown rendering #2

New Issue

openclaw · 2026-03-28T12:07:19Z

openclaw commented

2026-03-28 12:07:19 +00:00

Description

The renderMarkdown() function uses marked.parse() and assigns the result directly to innerHTML without sanitization.

Affected files

public/js/views/document.js
public/js/views/editor.js

Risk

If a user saves a document containing malicious markdown like:

[Click](javascript:alert(1))

![img](x onerror=alert(1))

The rendered HTML will execute JavaScript.

Recommendation

Use DOMPurify or a similar library to sanitize the marked output before inserting into innerHTML.

## Description The `renderMarkdown()` function uses `marked.parse()` and assigns the result directly to `innerHTML` without sanitization. ### Affected files - `public/js/views/document.js` - `public/js/views/editor.js` ### Risk If a user saves a document containing malicious markdown like: ```markdown [Click](javascript:alert(1)) ![img](x onerror=alert(1)) ``` The rendered HTML will execute JavaScript. ### Recommendation Use DOMPurify or a similar library to sanitize the marked output before inserting into innerHTML.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: proyectos/simplenote-web#2